NetScaler Zero-Days Exploited for Weeks Before Citrix Patched

A patch that came after the shutdowns

On the last weekend of September, many organizations running Citrix NetScaler did something unusual. They switched off the appliance that handles their remote access before any advisory, CVE number, or patch existed. Citrix confirmed the threat afterward. On September 27, 2026, it published security bulletin CTX697096, which acknowledged two critical remote code execution flaws, CVE-2026-88771 and CVE-2026-88772, and said both had been exploited against unmitigated deployments.113 Both carry a CVSS 4.0 score of 9.5. The same bulletin fixed six other NetScaler bugs, so it covered eight vulnerabilities in total.1114

The sequence matters more than any single detail. Admins acted first and the vendor confirmed later. That gap between attacker activity and public disclosure is the real story here. It is also why patching alone should not end the response.

What the two flaws do

CVE-2026-88771 is an input validation flaw. It lets an unauthenticated attacker run arbitrary commands, and Citrix says it affects every NetScaler ADC and Gateway deployment, including default configurations, with no extra feature needed.132 CVE-2026-88772 is a memory overflow that can lead to code execution or denial of service on appliances with DTLS enabled. DTLS is on by default for VPN virtual servers, so most Gateway installs are exposed unless an admin turned it off.216

The fixed builds are 14.1-73.37 and 13.1-64.23, plus matching FIPS and NDcPP releases.16 Appliances on the builds that fixed August's exploited authentication bypass, CVE-2026-19490, are still in the vulnerable range and need the new update.2 CISA added both CVEs to its Known Exploited Vulnerabilities catalog the day the bulletin came out. It warned that threat actors were exploiting them globally and gave federal agencies until September 30 to fix them.120

How the warning reached admins before the advisory

The early warnings travelled through private, uneven channels. Administrators on Reddit said IT suppliers, CERTs, and managed detection providers told them to shut down their appliances immediately, often without saying why.1 Much of that advice traced back to a pre-notification from the Dutch National Cyber Security Centre (NCSC-NL), which was reportedly shared under TLP restrictions. According to a copy that circulated, the agency learned of the two zero-days from a European partner CERT, and exploitation had been seen at multiple Citrix customers worldwide.113 The notice also reportedly said Citrix found the flaws while responding to customer incidents and filed a notification under the EU Cyber Resilience Act.3

On September 26, watchTowr said publicly that multiple unpatched NetScaler RCE flaws were being exploited, that its information came from forensic investigations, and that patches were expected early the next week.11 Researcher Kevin Beaumont backed this up the same day and told sensitive operators to switch their appliances off.16

The reporting agrees on the core sequence but shows a two-tier result. Some admins pulled the plug based on a restricted notice passed down through their CERT, while others heard nothing official.19 One plausible reading is that the Cyber Resilience Act reporting chain worked quickly for organizations inside the right national networks and left everyone else to learn from Reddit. That gap matters when the advice is to take down core remote-access infrastructure.

How long attackers had a head start

The reported start dates differ, but every account puts exploitation well before September 27. Mandiant and Google Threat Intelligence Group (GTIG) say the CVE-2026-88772 campaign has run since at least early September. They report that likely victims include government, financial services, technology, education, and legal organizations in North America and Europe.21 Unit 42 saw an attacker repeatedly requesting files from a VPN scripts folder between September 4 and 24.24 Australia's ACSC told organizations to look for compromise going back to at least September 4. eSentire reportedly saw CVE-2026-88771 exploited as early as September 5.22

Other observations are narrower. Rapid7 dates its earliest CVE-2026-88771 attempts to September 20 and has confirmed only two compromised organizations.14 GreyNoise caught an attempt on September 24 from a single IP address that tried to plant a password-protected PHP web shell and redirect requests for CSS files to it.15 These timelines most likely reflect different vantage points rather than conflicting facts. A quiet, targeted campaign starting in early September fits all of them. Companies watching their own customers' traffic would see it at different points.

WatchTowr's CEO said the patch his team analyzed was dated September 24. That suggests Citrix knew about the problem several days before it published, although the vendor's exact timeline is not public.

The tools, and who is behind them

GTIG's analysis gives the clearest technical picture. Exploiting CVE-2026-88772 bypasses authentication and crashes the NetScaler Packet Processing Engine, which gives the attacker root access. From there the attackers installed new custom PHP web shells such as WHIPSHOT, which can hide Base64-encoded command traffic inside normal HTTP headers.21 A Python tunneling tool called SLAPSHOT connected the compromised appliance to internal networks. Mandiant says the pair supported reconnaissance, lateral movement, and credential theft, and that in at least one case attackers used the tunnel to explore a network by hand.23 Mandiant also found intrusions where web server settings were changed so that .deb or .ico requests ran malicious PHP.15

No one has formally named a threat actor, and some coverage overstates this. One analysis said Mandiant and GTIG "attribute" the campaign to a state-backed group.26 The more careful accounts say Mandiant's CTO Charles Carmakal described suspected state-sponsored actors as likely behind the first intrusions without naming anyone, and that no vendor has made a formal attribution.22 Beaumont said he knew of more than 100 victim organizations and described the activity as espionage. Carmakal said dozens of organizations were hit.23 The best-supported reading is a capable, probably state-aligned espionage operation against a few chosen sectors, not a smash-and-grab.

The ransomware question

No ransomware deployment has been publicly tied to these CVEs so far. Tenable lists ransomware use for all three as "unknown." That status may not last. Tenable's own research finds that about one-third of threat actor activity against NetScaler over the past seven years came from ransomware groups and their affiliates, with APT groups making up the rest. Carmakal said he expects broad, opportunistic exploitation of both flaws by many actors in the near term.23

The coverage disagrees on how far that shift has gone. On September 29, watchTowr published a root-cause analysis and proof-of-concept code for CVE-2026-88771. One outlet reported mass exploitation within minutes of the release, and it also noted that no public exploit exists for CVE-2026-88772. SOCRadar described a suspected automated framework that scans for exposed NetScalers, fingerprints them, exploits CVE-2026-88771, and drops a polling agent.20 Palo Alto Networks counted 50,277 exposed instances that may be vulnerable as of September 27.12 In this analysis, the combination of a public exploit, automated tooling, and that many exposed devices is the setup that preceded ransomware campaigns built on earlier NetScaler bugs such as CitrixBleed. Defenders should assume the same could happen here.

A third zero-day within a week

The second wave came quickly. On October 3 and 4, admins who had just patched began seeing appliances crash and reboot again. Citrix then disclosed CVE-2026-88779, a SAML memory overflow rated 8.7 that it described as an exploited denial-of-service flaw.85 Fixing it required new builds, 14.1-73.41 and 13.1-64.28, so affected customers had to upgrade twice in a week.8 One administrator found crafted authentication usernames containing shell commands right before crashes. Beaumont also pointed out that an earlier NetScaler bug first described as denial of service later turned out to allow code execution.8 One analyst said attackers may be using the crash bug to cover attempts on the earlier flaws, though that is his assessment, not a confirmed finding.10

Why patching is not enough

The main lesson is clear across the coverage: a patched appliance can still be compromised. Updating the firmware does not remove a web shell that is already installed. Guidance from CISA and others is to check for compromise and save forensic evidence before upgrading where possible.20 For appliances that may have been compromised, recommended steps include taking snapshots and core dumps, isolating the device, rotating every stored credential, and revoking its certificates.2 Disabling DTLS or blocking inbound UDP/443 only mitigates CVE-2026-88772. CVE-2026-88771 stays exploitable on its own.20

This case also points to a structural problem. One security firm noted that NetScaler has produced a serious vulnerability every two to three months in 2026, and that this was the first time this year attackers began exploiting a flaw before any patch existed.3 When a device that sits at the edge of the network and runs as root keeps getting hit by attackers who know more than defenders, the edge cannot be the only line of defense. Organizations need detection and access controls behind the gateway, and they should assume the gateway itself may be compromised.